import json
from collections import defaultdict

class DynamicAnalyzer:
    def __init__(self, sandbox_log):
        with open(sandbox_log) as f:
            self.logs = json.load(f)
            
    def extract_api_features(self):
        """提取API调用特征"""
        features = {
            'api_sequence': [],
            'category_counts': defaultdict(int),
            'risk_score': 0
        }
        
        for entry in self.logs['behavior']['processes']:
            for call in entry['calls']:
                # 记录API调用序列
                features['api_sequence'].append(call['api'])
                
                # 统计高危API类别
                category = self._classify_api(call['api'])
                features['category_counts'][category] += 1
                features['risk_score'] += self._risk_weight(category)
                
        return features
    
    def _classify_api(self, api_name):
        """API分类逻辑"""
        if 'CreateProcess' in api_name:
            return 'Process'
        elif 'RegSetValue' in api_name:
            return 'Registry'
        elif 'WriteFile' in api_name:
            return 'File'
        return 'Other'
    
    def _risk_weight(self, category):
        """风险权重配置"""
        weights = {'Process': 2, 'Registry': 3, 'File': 1}
        return weights.get(category, 0) 